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U.S. as World s Telecommunications Backbone 


* Much of the world's ON 
communications flow 
through the U.S. y A 
* Atarget's phone call, e-mail | 
or chat will take the ili 11 Gbps "dd 
cheapest path, not the $ : 
physically most direct 3 
path — you can't always $ e § 
predict the path. s 3 
* Your target's 
communications could 
easily be flowing into and 
through the U.S. 


Latin America Asia & Pacific 


International Internet Regional Bandwidth Capacity in 2011 
Source: Telegeography Research 
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Two Types of Collection 


Upstream 
"Collection Of 


You 
Should 
Use Both | 

d PRISM 
* Collection directly from the servers of these U.S. 
Service Providers: Microsoft, Yahoo, Google 


Facebook, PalTalk, AOL, Skype, YouTube 
Apple. 
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Why Use Both: PRISM vs. Upstream 


PRISM Upstream 

DNI Selectors 9 US. based service Worldwide 
Im d providers ^ sources 

DNR Selectors QS oming soon Z 0. 
Access to Stored 
Communications 
(Search) Y O 
Real-Time Collection 
(Surveillance) Y Y 
“Abouts” Collection O v” 
Voice Collection «f Voice over IP v 


Direct Relationship with 
Comms Providers Oony through FBI 


TOP SECRET//SI/ORCON/NOFORN 


TOP SECRET//SI/ORCON//NOEORN 
Gmail facebook 
rä ` 


Y^ Hotmail ( ;oogle | de m 

msn 3t ss «VDe; paltalk .com. (me 
- 8 ^ Communcaice Beyond Words 

YAHOO! d ST AOL mail & 


\ 
| 


ZN PRISM Collection Details yay 
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What Will You Receive ın Collection 
(Surveillance and Stored Comms)? 
It varies by provider. In general: 


Current Providers 


E-mail 


* Chat- video, voice 
* Videos 
* Photos 
Stored data 
VoIP 


File transfers 


Video Conferencing 
* Notifications of target activity — logins, etc. 
* Online Social Networking details 


Special Requests 


Complete list and details on PRISM web page: 
Go PRISMFAA TOP SECRET/'SI/ORCON/NOFORN 
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d (susup Dates When PRISM Collection | 
| Began For Each Provider 
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PRISM Program Cost: 
~$20M per year 
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(IS/SUNF) FAA 702 Reporting Highlight 
PRISM.and STORMBREW Combine 


wa | 
SAME-DAY NTOC/FBI COLLABORATION 


PREVENTS 150GB EXFIL EVENT FROM CLEARED DEFENSE CONTRACTOR (CDC) 


2012 14 DEC 3 
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5 FBİ HELPS CDR 
REMOVE ] 
IMPLANT 


€ The FBI contacts the 
CDC and works with 


NTOC TIPS FBI TO 
den INENT THREAT, 
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2) NTOC tips the 
FBI to the activity 
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(tsst’NF) Some Higher Volume Domains 
Collected from FAA Passive 


In addition to Hotmail, Yahoo, Google, Paltalk, Facebook, Skype, AOL: 
Select IP Addresses 


wanadoo.fr 


alcatel-lucent.com 
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Target Analyst inputs selectors into 
Unified Targeting Tool (UTT 


Surveillance - — —— Pending Stored Comms 


Special FISA Oversight and Processing 
(SV4) 


Stored Comms Review /Validation 


Surveillance > <— Pending Stored Comms 
Targeting and Mission Management (S343) 
Final Targeting Review and Release 


Unified Targeting Tool (UTT) 


S2 FAA Adjudicators in Each Product Line 


Targeting Review/Validation 


PRINTAURA; Site Selector 


Distribution Manager 


— Pending Stored Comms 
FBI 
Electronic Communications Surveillance Unit (ECSU) 
Research & Validate NO USPERs 


Surveillance ——» 


Targeting < Stored Comms Release 


Providers Selectors 


PINWALE, 


FBI 


(Google, 
Yahoo, etc.) Callactian 


NUCLEON, 
etc. 
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Data Intercept Technology Unit (DITU) 


Collection 
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Exploitation. 
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(TS//SI/NF) PRISM Case Notations 


P2ESQC 120001234 


əə Sk de | Fixed trigraph, denotes || Year CASN established Em 
ə i PRISM source collection for selector 


: Google 
L Facebook 


E B: IM (chat) 
: YouTube C: RTN-EDC (real-time notification of an e-mail event such as a login 
: Skype or sent message) 
P8: AOL D: RTN-IM (real-time notification of a chat login or logout event) 
PA: Apple E: E-Mail 
F: VolP 
G: Full (WebForum) 
H: OSN Messaging (photos, wallposts, activity, etc.) 
I: OSN Basic Subscriber Info 
J: Videos 
. (dot): Indicates multiple types 


Content Type 
A: Stored Comms (Search) 
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